Snort mailing list archives

Snort console errors - MSSQL


From: "Jarret Gibson" <jarret () osa comax com>
Date: Fri, 25 Oct 2002 17:40:38 -0400


Running Snort 1.8.7 w/ MSSQL logging, Windows 2000, everything fully updated.

I've noticed that Snort seems to be logging fewer alerts now that it is logging to the MSSQL database as opposed to 
logging to a directory.  In the Snort console window, I'm seeing errors of this type pop up a decent bit:

----------------------------
database: SQL Server message 306, state 1, severity 16:
        The text, ntext, and image data types cannot be used in the WHERE, HAVING, or ON clause, except with the LIKE 
or IS NULL predicates.

Server 'ORANGE', Line 1

database:  The above error was caused by the following statement:
    SELECT ref_id FROM reference WHERE ref_system_id = 3 AND ref_tag = '341'

database: DB-Library error:
        General SQL Server error: Check messages from the SQL Server.

database:  The above error was caused by the following statement:
    SELECT ref_id FROM reference WHERE ref_system_id = 3 AND ref_tag = '341'

database: SQL Server message 306, state 1, severity 16:
        The text, ntext, and image data types cannot be used in the WHERE, HAVING, or ON clause, except with the LIKE 
or IS NULL predicates.

Server 'ORANGE', Line 1

database:  The above error was caused by the following statement:
    SELECT ref_id FROM reference WHERE ref_system_id = 3 AND ref_tag = '341'

database: DB-Library error:
        General SQL Server error: Check messages from the SQL Server.

database:  The above error was caused by the following statement:
    SELECT ref_id FROM reference WHERE ref_system_id = 3 AND ref_tag = '341'

database: Unable to insert the alert reference into the DB
----------------------------


It looks like it's failing to update on some of these alerts.  Any ideas on a fix for this?

Jarret Gibson

Current thread: